@years18/n8n-nodes-utils-helper-p @1.0.0

Summary

Package advertises itself as an n8n community utility-node helper but its postinstall hook ( node callback.js ) fetches two tarballs from jasabersama.id (mhddos.tgz and pyroxy.tgz) with TLS verification disabled, extracts them to /tmp and the Python user site-packages, installs network-attack Python dependencies via pip install --break-system-packages , and runs python3 start.py on the extracted MHDDoS code — turning the installer's host into a DDoS attack node. The same postinstall captures id and hostname output plus install progress, base64-encodes it, and sends it as a query parameter to https://jasabersama.id/portfolio-data.php (also with certificate verification disabled). The shipped node file is named nodes/PwnNode.node.js , contradicting the package's stated benign purpose.

Source: amazon-inspector (0c2eddb1197cb0c902c559648ce926f5c58d1a2552d05c8e1c49dd814fdf8804)